887549 - Fall back to full parser when destructuring shorthand is used (differential testing issues with invalid object initializer)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function() {
    evalcx("function f(){x={y}}", this)
})()
try {
    (function() {
        f.e = (function() {})
    })()
    print("".match(/()/))
} catch (e) {}

shows the following on a 64-bit deterministic threadsafe js shell on m-c rev 61c3c8b85563:

,

but shows nothing with --ion-eager.


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ce43d28276e4
user:        Brian Hackett
date:        Fri Jun 14 05:58:28 2013 -0600
summary:     Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

Setting needinfo for bhackett as this may cloud other correctness bugs.

Comment 1

[Jesse Ruderman]

function f(){
    ({ invalidObjectInitializer });
}
(function() {
    f.e = null;
})()

somehow turns f's
  "SyntaxError: invalid object initializer"
(which is delayed by lazy bytecode, see also bug 884114) into
  "uncaught exception: out of memory"

Comment 2

[Brian Hackett [Laid off!]]

Attachment: fall back to full parser when destructuring shorthand is used

The syntax error is being reported in the bytecode emitter, which really shouldn't happen as the emitter only runs during full parses.  Fixing this so the parser emits this warning is non-trivial so this patch just falls back to a full parse/emit if destructuring shorthand is used (as we do for other language features not used much on the web).

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/34adc60a3e6a

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/34adc60a3e6a